DM×××-白红宇

DM×××

阅读量：5755 次

发布时间：2019-06-18

本文共 8100 字，大约阅读时间需要 27 分钟。

DM×××是思科私有的技术,

配置顺序:

1.MGRE

interface Tunnel0

ip address 172.16.1.1 255.255.255.0

tunnel source FastEthernet0/0

tunnel mode gre multipoint

tunnel key 12345

!在这里不用定义目的,必须敲tunnel key只有敲了key它才up

interface Tunnel0

ip address 172.16.1.2 255.255.255.0

tunnel source FastEthernet0/0

tunnel mode gre multipoint

tunnel key 12345

interface Tunnel0

ip address 172.16.1.100 255.255.255.0

tunnel source FastEthernet0/0

tunnel mode gre multipoint

tunnel key 12345

2 NHRP 网络下一跳解析协议,解决了物理IP和虚拟IP的映射,它需要一个server,这个server就是NHS,一般用HUB来做,分支必须得知道中心的IP映射

R1在t0下

ip nhrp map 172.16.1.100 202.100.1.100

ip nhrp network-id 10

ip nhrp nhs 172.16.1.100

!所用的network-id都要相同,NHS必须固定IP,客户端的IP可以变动,客户端一上线,就会注册自己的真实IP和虚拟IP,任意站点间的通信是直接的,不经过中心站点

R2在t0下

ip nhrp map 172.16.1.100 202.100.1.100

ip nhrp nhs 172.16.1.100

ip nhrp network-id 10

R3在t0下

ip nhrp network-id 10

看注册情况(如果没有结果,将所有的T0sh/no sh)

r3#show ip nhrp

172.16.1.1/32 via 172.16.1.1, Tunnel0 created 00:47:23, expire 01:48:27

Type: dynamic, Flags: unique nat registered

NBMA address: 202.100.1.1

172.16.1.2/32 via 172.16.1.2, Tunnel0 created 00:46:47, expire 01:49:01

Type: dynamic, Flags: unique nat registered

NBMA address: 202.100.1.2

r3#

r1#show ip nhrp

172.16.1.1/32 via 172.16.1.1, Tunnel0 created 00:45:51, expire 01:14:08

Type: dynamic, Flags: router unique nat local

NBMA address: 202.100.1.1

(no-socket)

172.16.1.2/32 via 172.16.1.2, Tunnel0 created 00:45:52, expire 01:14:09

Type: dynamic, Flags: router nat

NBMA address: 202.100.1.2

172.16.1.100/32 via 172.16.1.100, Tunnel0 created 00:52:10, never expire

Type: static, Flags: nat used

NBMA address: 202.100.1.100

r1#

3 路由协议

实现组播宣告和EIGRP

R1在t0下

ip nhrp map multicast dynamic

ip nhrp map multicast 202.100.1.100

router eigrp 1

network 172.16.1.00.0.0.255

network 192.168.1.0

no auto-summary

!一定要关闭自动汇总,只需要宣告内网IP和GRE接口的IP

R2在t0下

ip nhrp map multicast dynamic

ip nhrp map multicast 202.100.1.100

router eigrp 1

network 172.16.1.00.0.0.255

network 192.168.2.0

no auto-summary

R3在t0下

ip nhrp map multicast dynamic

ip nhrp map multicast 202.100.1.100

router eigrp 1

network 172.16.1.00.0.0.255

network 192.168.100.0

no auto-summary

看EIGRP的邻居(如果没有邻居,需要sh/no sh从中心站点开始打开各个站点的隧道接口所有路由器的T0接口,)

r3#show ip eigrp neighbors

IP-EIGRP neighbors for process 1

H Address Interface Hold Uptime SRTT RTO Q Seq

(sec) (ms) Cnt Num

1 172.16.1.2 Tu0 12 01:04:31 90 5000 0 29

0 172.16.1.1 Tu0 11 01:05:03 65 5000 0 30

r3#

r1#

r1#show ip eigrp neighbors

IP-EIGRP neighbors for process 1

H Address Interface Hold Uptime SRTT RTO Q Seq

(sec) (ms) Cnt Num

0 172.16.1.100 Tu0 11 01:05:37 145 5000 0 55

r1#

R1和R2互相学不到对方的路由,关闭R3T0口的水平分割,

no ip split-horizon eigrp 1

在这里必须带eigrp 1关键字,否则只对RIP起作用.

在R3T0接口下

no ip next-hop-self eigrp 1

它可以实现两个分支的路由器学习到的路由条目自动调为最优,是真实的下一跳,分支之间就可以互相通了,不一定非得经过中心路由器.

查R1和R2的路由表

r1#show ip route

Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP

D - EIGRP, EX - EIGRP external, O -OSPF,IA- OSPF inter area

N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

E1 - OSPF external type 1, E2 - OSPF external type 2

i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2

ia - IS-IS inter area, * - candidate default, U - per-user static route

o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

172.16.0.0/24 is subnetted, 1 subnets

C 172.16.1.0 is directly connected, Tunnel0

C 202.100.1.0/24 is directly connected, FastEthernet0/0

C 192.168.1.0/24 is directly connected, Loopback0

D 192.168.2.0/24 [90/310172416] via 172.16.1.2, 01:13:00, Tunnel0

D 192.168.100.0/24 [90/297372416] via 172.16.1.100, 01:13:32, Tunnel0

r1#

r2#show ip route

Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP

D - EIGRP, EX - EIGRP external, O -OSPF,IA- OSPF inter area

N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

E1 - OSPF external type 1, E2 - OSPF external type 2

i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2

ia - IS-IS inter area, * - candidate default, U - per-user static route

o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

172.16.0.0/24 is subnetted, 1 subnets

C 172.16.1.0 is directly connected, Tunnel0

C 202.100.1.0/24 is directly connected, FastEthernet0/0

D 192.168.1.0/24 [90/310172416] via 172.16.1.1, 01:13:28, Tunnel0

C 192.168.2.0/24 is directly connected, Loopback0

D 192.168.100.0/24 [90/297372416] via 172.16.1.100, 01:13:28, Tunnel0

r2#

4 ipsec ***

是一个标准的GRE over ipsec,用传输模式

R1、R2和R3的配置是一样的

crypto isakmp policy 10

authentication pre-share

crypto isakmp key 0 cisco address0.0.0.0 0.0.0.0

crypto ipsec transform-set cisco esp-des esp-md5-hmac

mode transport

crypto ipsec profile cisco

set transform-set cisco

interface Tunnel0

tunnel protection ipsec profile cisco

做完之后如果不通，SH/NO SH命令T0接口

r3#show crypto isakmp sa

IPv4 Crypto ISAKMP SA

dst src state conn-id slot status

202.100.1.100 202.100.1.2 QM_IDLE 1004 0 ACTIVE

202.100.1.100 202.100.1.1 QM_IDLE 1005 0 ACTIVE

IPv6 Crypto ISAKMP SA

r3#！中心知道到所有分支的遂道

r1#ping 192.168.2.1 source 192.168.1.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.2.1, timeout is 2 seconds:

Packet sent with a source address of 192.168.1.1

!!!.!

Success rate is 100 percent (5/5), round-trip min/avg/max = 20/32/44 ms

r1#

!分支之间的通信一开始是由中心转的,后来双方就直接通信,中间有可能会出现有包不通的情况,这是正常现象

r1#show crypto isakmp sa

IPv4 Crypto ISAKMP SA

dst src state conn-id slot status

202.100.1.2 202.100.1.1 QM_IDLE 1005 0 ACTIVE

202.100.1.1 202.100.1.2 QM_IDLE 1004 0 ACTIVE

202.100.1.100 202.100.1.1 MM_NO_STATE 1001 0 ACTIVE (deleted)

IPv6 Crypto ISAKMP SA

r1#在这里×××用传输模式就可以了,在这个环境当中只需要中心1个IP就可以了,其它的都可以是动态的地址,正是因为客户端的地址是变动的,所以无论分支还是中心,×××的PEER用0.0.0.0来做.分支一开始只知道中心的遂道，分支之间是按需的,当有流量时分支之间才会建立遂道。

路由器最后的配置

R1的配置

hostname r1

crypto isakmp policy 10

authentication pre-share

crypto isakmp key cisco address0.0.0.0 0.0.0.0

crypto ipsec transform-set cisco esp-des esp-md5-hmac

mode transport

crypto ipsec profile cisco

set transform-set cisco

interface Loopback0

ip address 192.168.1.1 255.255.255.0

interface Tunnel0

ip address 172.16.1.1 255.255.255.0

ip nhrp map multicast dynamic

ip nhrp map 172.16.1.100 202.100.1.100

ip nhrp map multicast 202.100.1.100

ip nhrp network-id 10

ip nhrp nhs 172.16.1.100

tunnel source FastEthernet0/0

tunnel mode gre multipoint

tunnel key 12345

tunnel protection ipsec profile cisco

interface FastEthernet0/0

ip address 202.100.1.1 255.255.255.0

duplex half

router eigrp 1

network 172.16.1.00.0.0.255

network 192.168.1.0

no auto-summary

R2的配置

hostname r2

crypto isakmp policy 10

authentication pre-share

crypto isakmp key cisco address0.0.0.0 0.0.0.0

crypto ipsec transform-set cisco esp-des esp-md5-hmac

mode transport

crypto ipsec profile cisco

set transform-set cisco

interface Loopback0

ip address 192.168.2.1 255.255.255.0

interface Tunnel0

ip address 172.16.1.2 255.255.255.0

ip nhrp map multicast dynamic

ip nhrp map 172.16.1.100 202.100.1.100

ip nhrp map multicast 202.100.1.100

ip nhrp network-id 10

ip nhrp nhs 172.16.1.100

tunnel source FastEthernet0/0

tunnel mode gre multipoint

tunnel key 12345

tunnel protection ipsec profile cisco

interface FastEthernet0/0

ip address 202.100.1.2 255.255.255.0

duplex half

router eigrp 1

network 172.16.1.00.0.0.255

network 192.168.2.0

no auto-summary

R3的配置

hostname r3

crypto isakmp policy 10

authentication pre-share

crypto isakmp key cisco address0.0.0.0 0.0.0.0

crypto ipsec transform-set cisco esp-des esp-md5-hmac

mode transport

crypto ipsec profile cisco

set transform-set cisco

interface Loopback0

ip address 192.168.100.1 255.255.255.0

interface Tunnel0

ip address 172.16.1.100 255.255.255.0

no ip next-hop-self eigrp 1

ip nhrp map multicast dynamic

ip nhrp map multicast 202.100.1.100

ip nhrp network-id 10

no ip split-horizon eigrp 1

tunnel source FastEthernet0/0

tunnel mode gre multipoint

tunnel key 12345

tunnel protection ipsec profile cisco

interface FastEthernet0/0

ip address 202.100.1.100 255.255.255.0

duplex half

router eigrp 1

network 172.16.1.00.0.0.255

network 192.168.100.0

no auto-summary

转载于:https://blog.51cto.com/sngyqd/624828

你可能感兴趣的文章

多项式前k项和java_多项式朴素贝叶斯softmax改变

查看>>

java数组只能交换0下标和n_编程练习-只用0交换排序数组

查看>>

centos7安装mysql视频教程_centos7安装mysql（完整）

查看>>

php图片赋值,php如何优雅地赋值

查看>>

【探索HTML5第二弹01】HTML5的前世今生以及来世

查看>>

Failed to connect to remote VM. Connection refused. Connection refused: connect

设计模式 ( 十八 )：State状态模式 -- 行为型

查看>>

OracleLinux安装说明

查看>>

nova分析（7）—— nova-scheduler

查看>>

Entity Framework 实体框架的形成之旅--Code First模式中使用 Fluent API 配置（6）

查看>>

OpenMediaVault 搭建git，ssh无法连接问题

查看>>

java多线程之：Java中的ReentrantLock和synchronized两种锁定机制的对比（转载）

Apache Storm 官方文档 —— FAQ

查看>>

iOS 高性能异构滚动视图构建方案 —— LazyScrollView

查看>>

Java 重载、重写、构造函数详解

查看>>

【Best Practice】基于阿里云数加·StreamCompute快速构建网站日志实时分析大屏

查看>>